CVE-2018-11671

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/GreenCMS/GreenCMS/issues/109Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44826/Exploit, Third Party Advisory, VDB Entry
https://github.com/GreenCMS/GreenCMS/issues/109Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44826/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jun 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-116789.8plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.CVE-2018-116798.8An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&tab CVE-2018-11687.8This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacke CVE-2018-116806.5An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This CVE-2018-116819.8Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device throu CVE-2018-116829.8Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to pr CVE-2018-116838.8Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE CVE-2018-116848.8Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.CVE-2018-116858.8Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.CVE-2018-116869.8The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.CVE-2018-116877.5An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red (BTCR), an Ethereum ERC20 token, allows CVE-2018-116886.1Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote